Metabase Jar file not signed causing issues

Get Help
1

Hey everyone,

I know that the Jar files haven't been signed for a while, however, with the latest upgrade to Java 21 and the latest 55 release our Jar files are returning an error "The JCE Provider file:/usr/local/metabase/metabase.jar is not signed."

This has been causing us a number of issues. I've tried signing them manually myself but that goes into deeper issues. So I was wondering if anyone knew the way around this that isn't signing them yourself!

My system is Debian 12 and we have installed Oracle's Java 21 deb package.

Thank you in advance!

Kind regards,
Ryan Henderson.

2

This is unique to Oracle Java. From the Oracle JDK 21 release notes:

Oracle JDK requires that third-party cryptographic providers be signed with a Java Cryptography Extension (JCE) Code Signing Certificate. OpenJDK continues allowing the use of unsigned third-party crypto providers.

If you don't need to use Oracle Java, you can use OpenJDK instead and it won't ~censored~ be unhappy.

Ideally, Metabase should be distributing a signed jar. I'm not familiar with the jar signing process for a public application, though, so there may be complications.